We implement a PST attack with the same parameters used in [1]} and report the results in Table REF . Only for three of the twelve models, the accuracy drop to below \(75\%\) , although still above \(60\%\) . Considering the difficulty of learning pn-IID datasets, this drop might be because of the inadequate capability of LeNet for CIFAR10 or a bad local minimum. The results indicate that PST attacks can have an impact on our watermark to some extent, but are not consistently effective against our trigger set.
